Home[1] Files[2] News[3] &[SERVICES_TAB] Contact[4] Add New[5]
- Ubuntu Security Notice USN-6142-1[6]
- Authored by Ubuntu[7] | Site security.ubuntu.com[8]
-
Ubuntu Security Notice 6142-1 - Gal Goldshtein discovered that nghttp2 incorrectly handled certain inputs. If a user or an automated system were tricked into opening a specially crafted input file, a remote attacker could possibly use this issue to cause a denial of service.
- systems | linux[9], ubuntu[10]
- advisories | CVE-2020-11080[11]
- SHA-256 |
8db0cfa1ab9c208a5c6578a0215c4766c126c7705ad9c0c431e5eb80778831e7
- Download[12] | Favorite[13] | View[14]
Change Mirror[15] Download[16]
==========================================================================
Ubuntu Security Notice USN-6142-1
June 06, 2023
nghttp2 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS (Available with Ubuntu Pro)
- Ubuntu 16.04 LTS (Available with Ubuntu Pro)
Summary:
nghttp2 could be made to crash if it opened a specially crafted file.
Software Description:
- nghttp2: HTTP/2 C Library and tools
Details:
Gal Goldshtein discovered that nghttp2 incorrectly handled certain inputs. If
a user or an automated system were tricked into opening a specially crafted
input file, a remote attacker could possibly use this issue to cause a
denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 20.04 LTS:
libnghttp2-14 1.40.0-1ubuntu0.1
libnghttp2-dev 1.40.0-1ubuntu0.1
nghttp2 1.40.0-1ubuntu0.1
nghttp2-client 1.40.0-1ubuntu0.1
nghttp2-proxy 1.40.0-1ubuntu0.1
nghttp2-server 1.40.0-1ubuntu0.1
Ubuntu 18.04 LTS (Available with Ubuntu Pro):
libnghttp2-14 1.30.0-1ubuntu1+esm1
libnghttp2-dev 1.30.0-1ubuntu1+esm1
nghttp2 1.30.0-1ubuntu1+esm1
nghttp2-client 1.30.0-1ubuntu1+esm1
nghttp2-proxy 1.30.0-1ubuntu1+esm1
nghttp2-server 1.30.0-1ubuntu1+esm1
Ubuntu 16.04 LTS (Available with Ubuntu Pro):
libnghttp2-14 1.7.1-1ubuntu0.1~esm1
libnghttp2-dev 1.7.1-1ubuntu0.1~esm1
nghttp2 1.7.1-1ubuntu0.1~esm1
nghttp2-client 1.7.1-1ubuntu0.1~esm1
nghttp2-proxy 1.7.1-1ubuntu0.1~esm1
nghttp2-server 1.7.1-1ubuntu0.1~esm1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-6142-1
CVE-2020-11080
Package Information:
https://launchpad.net/ubuntu/+source/nghttp2/1.40.0-1ubuntu0.1
File Tags
- ActiveX[22] (932)
- Advisory[23] (81,326)
- Arbitrary[24] (16,055)
- BBS[25] (2,859)
- Bypass[26] (1,691)
- CGI[27] (1,024)
- Code Execution[28] (7,153)
- Conference[29] (678)
- Cracker[30] (841)
- CSRF[31] (3,317)
- DoS[32] (23,181)
- Encryption[33] (2,363)
- Exploit[34] (51,147)
- File Inclusion[35] (4,193)
- File Upload[36] (954)
- Firewall[37] (821)
- Info Disclosure[38] (2,716)
- Intrusion Detection[39] (883)
- Java[40] (3,002)
- JavaScript[41] (840)
- Kernel[42] (6,571)
- Local[43] (14,390)
- Magazine[44] (586)
- Overflow[45] (12,613)
- Perl[46] (1,423)
- PHP[47] (5,123)
- Proof of Concept[48] (2,302)
- Protocol[49] (3,566)
- Python[50] (1,504)
- Remote[51] (30,508)
- Root[52] (3,554)
- Rootkit[53] (506)
- Ruby[54] (609)
- Scanner[55] (1,633)
- Security Tool[56] (7,852)
- Shell[57] (3,163)
- Shellcode[58] (1,211)
- Sniffer[59] (893)
- Spoof[60] (2,189)
- SQL Injection[61] (16,230)
- TCP[62] (2,394)
- Trojan[63] (687)
- UDP[64] (883)
- Virus[65] (664)
- Vulnerability[66] (31,592)
- Web[67] (9,567)
- Whitepaper[68] (3,744)
- x86[69] (961)
- XSS[70] (17,685)
- Other[71]
File Archives
- June 2023[72]
- May 2023[73]
- April 2023[74]
- March 2023[75]
- February 2023[76]
- January 2023[77]
- December 2022[78]
- November 2022[79]
- October 2022[80]
- September 2022[81]
- August 2022[82]
- July 2022[83]
- Older[84]
Systems
- AIX[85] (428)
- Apple[86] (1,979)
- BSD[87] (373)
- CentOS[88] (57)
- Cisco[89] (1,920)
- Debian[90] (6,754)
- Fedora[91] (1,691)
- FreeBSD[92] (1,244)
- Gentoo[93] (4,321)
- HPUX[94] (879)
- iOS[95] (344)
- iPhone[96] (108)
- IRIX[97] (220)
- Juniper[98] (67)
- Linux[99] (45,838)
- Mac OS X[100] (685)
- Mandriva[101] (3,105)
- NetBSD[102] (256)
- OpenBSD[103] (482)
- RedHat[104] (13,356)
- Slackware[105] (941)
- Solaris[106] (1,610)
- SUSE[107] (1,444)
- Ubuntu[108] (8,642)
- UNIX[109] (9,244)
- UnixWare[110] (186)
- Windows[111] (6,555)
- Other[112]
- Services
- Security Services[123]
- Hosting By
- Rokasec[124]
Read more https://packetstormsecurity.com/files/172766/USN-6142-1.txt